152results about How to "Implement anomaly detection" patented technology

The invention relates to a condition monitoring data stream anomaly detection method, in particular to a condition monitoring data stream anomaly detection method based on an improved gaussian process regression model. The problem that an existing method for processing monitoring data stream anomaly detection is poor in effect is solved. The method comprises the steps that firstly, the historical data sliding window size is determined; secondly, the types of a mean value function and a covariance function are determined; thirdly, the hyper-parameter initial value is set to be the random number from 0 to 1; fourthly, q data closest to the current time t are extracted; fifthly, the gaussian process regression model is determined; sixthly, prediction is conducted by means of the nature of the gaussian process regression model; seventhly, PI of normal data at the time t+1; eighthly, monitoring data are compared with the PI; ninthly, whether the real monitoring data need to be marked to be abnormal or not is judged; tenthly, beta (xt+1) corresponding to the monitoring value at the time t+1 is calculated; eleventhly, the real value or prediction value and the t+1 are added into DT; twelfthly, new DT is created. The condition monitoring data stream anomaly detection method based on the improved gaussian process regression model is applied in the field of network communication.

The invention provides a massive log data intelligent operation and maintenance system. The system comprises a log collecting module, a log processing module, a log storage module and a business application module, wherein the log collecting module is used for collecting application logs, operation system logs and network equipment logs on a target machine, structuring log data and then outputtingthe log data to the log processing module; the log processing module is used for real-time processing and offline processing, real-time processing comprises real-time statistics, real-time alarming and real-time analysis, and offline processing comprises data batch storage, offline analysis and machine learning; then the processed information is sent to the log storage module; the log storage module is used for storing original log data, index data, statistical analysis data and resource configuration data, and comprises a MySQL relation database, a Redis memory database, an Elastic search engine and an HBase column storage database; the business application module is used for providing functions of inquiry statistics, monitoring and alarming, intelligent reports, instrument panels and knowledge bases through a web interface, and the data is read out from the log storage module.

The invention discloses an electric transmission and transformation device state abnormity detection method, comprising steps of installing an on-line comprehensive monitoring device at a transformer station to monitor state quantity, determining a corresponding relation between the state quantity and the device state, performing representation on a time sequence of device state quantity data by utilizing a high dimension random matrix, analyzing spectral distribution and circular ring rate of state data in various time quantum in an operation history in the operation history, converting the device state into a state evaluation value P through quantification, comparing a device state evaluation value P with a device state evaluation value threshold P to determine whether the device state matrix has abnormity and to detect the device state abnormity, and obtaining an abnormal state and an abnormal time according to the normality detection of a residual sequence matrix.

The invention provides a malicious code behavior analyzer which comprises a storage module, a display module, a network data flow collecting and reducing module, a central processor, an integrated management module, a network flow behavior analysis engine, a file static analysis engine, a file dynamic behavior analysis engine, a WEB threat detection module, a network behavior abnormity detection module, a threat detection module, a file threat detection module, a file abnormal behavior module and a sandbox module. According to the analyzer, the network data flow can be recombined and reduced, abnormal network behaviors are detected, suspected files can be reduced, extracted and analyzed, and placed in a sandbox template to monitor and analyze file behaviors dynamically, results of static analysis and dynamic analysis are combined to provide the degree of information safety risk of the suspected files, and the technical problem that high-level malicious code attacks which is increasingly serious cannot be handled is solved.

The invention discloses a log data exception detection method and device, a terminal and a medium. The method comprises the following steps: converting the acquired first log data sequence into a first identification sequence, wherein the first log data sequence is M pieces of system log data arranged in a time sequence of the first network equipment, the first identification sequence comprises Mlog identifications, M is an integer greater than 1, and a prediction result is obtained based on the first identification sequence and comprises at least one prediction log identification; acquiringsecond log data, wherein the second log data is the next system log data generated by the first network device after the first log data sequence; the second log data is converted into the corresponding target log identifier, the target log identifier is compared with the prediction result, and whether the second log data is abnormal data or not is determined, so that abnormality detection of the system log data of the network equipment can be realized more accurately and efficiently, and abnormality processing can be carried out in time.

The invention provides a method for detecting an abnormal time sequence without a class label, and aims at solving the problems that ideal effect of segmenting fixed points based on satellite remote detecting data cannot be achieved, the clustering number is manually set during layer-based clustering, and offline and online abnormality detection methods for the label time sequence without the class label are currently not developed. According to the technical scheme, the method comprises the steps of 1, segmenting the satellite remote detecting historical data according to the cycle property of the satellite remote detecting data to obtain the time sequence without class label, namely, X={x1, x2..., xn}; 2, performing adaptive layer-based clustering for the X={x1, x2..., xn} obtained in step 1, and determining and deleting the abnormal sequence in the time sequence without the class label to obtain the formulas as shown in the specification; 3, adopting the formulas as shown in the specification as samples, performing mode matching for the formula shown in the specification by the nearest neighbor algorithm according to the matching threshold, so as to finish the abnormal satellite remote detecting data detection. The method is applied to the field of satellite data detection.

The invention discloses an anomaly detection method specific to an IEC61850 protocol SV (Sample Value) message. The method comprises the following steps: firstly, detecting a format and configuration information of a frame of SV message, and ending subsequent detection if any of the format and the configuration information is wrong; if the format and the configuration information of the SV message are correct, continuing to perform logic analysis on an smpCnt value to judge whether abnormal phenomena such as disorder, loss and repetition of the message occur or not; if the smpCnt value is free from a logic error, continuing to detect state information of the SV message in order to detect whether the SV message is in an interrupt state or a synchronous state; and finally, if the message is not in an abnormal state, continuing to detect quality values (test and validity) of the message, and judging whether a quality factor of the message is abnormal or not. The method has the advantages of comprehensive analysis and clear logic, is simple, clear and efficient, and can be applied to online data analysis and anomaly detection of transformer substations.

The invention provides a log management system and an operation method thereof. The log management system comprises a data source layer, a data platform layer and a scene application layer. The data acquisition layer is used for acquiring data of the data source layer; the analysis and processing layer is used for processing the data acquired by the data acquisition layer through a queue, enablingthe processed data to enter the data platform layer in real time to be filtered and cleaned, performing real-time rule analysis processing on heterogeneous data sources of different formats through an analysis engine, and then loading the processed data into the storage and analysis layer to be stored and analyzed; after being analyzed by the algorithm engine, the data is called by the scene application layer in real time; the scene application layer is used for carrying out real-time detection on suspicious indexes in combination with in-line requirements, quickly responding to abnormal events and problems, tracing the source and establishing an operation and maintenance knowledge base; a security situation awareness scene is established in combination with various network security equipment events and rules in rows, various security events and potential threats are perceived in real time, and timely response and processing, advanced prediction and risk avoidance capability are achieved.

The invention provides a database user behavior security auditing method for internal and external network boundaries of electric power information. The method comprises the steps that logs are preprocessed, and effective data preparation is provided for user behavior auditing; an OCSVM trains and learns historical normal user behavior data, and a user behavior mode base is constructed and completed; and the OCSVM detects whether a database user access behavior is abnormal. Through the technical scheme, security auditing on a user abnormal behavior and security monitoring on the database user access behavior are realized, and deeper monitoring and protection are provided for data transmission between the internal and external network boundaries of the electric power information.

The embodiment of the invention provides an industrial control network abnormity detection method and device, and the method comprises the steps: automatically generating a security baseline in a certain time period based on an unsupervised baseline learning method, and carrying out the warning of an abnormal data frame or a data frame sequence; And when the security baseline is generated in the new time period, analyzing the change trend of the historical security baseline sequence in the preset time period, and predicting and alarming the potential security threat according to a trend analysis result. According to the embodiment, the abnormal detection of the industrial control network is realized; manual adjustment and confirmation after the network security baseline is generated basedon supervised learning in advance are not needed; the network security baseline is automatically generated according to the continuously obtained network traffic, the potential threat that the baseline sequence gradually deviates from the normal value can be found by analyzing the trend of the historical baseline sequence, and the method reduces the operation complexity of generating the industrial control security baseline and improves the stability of the security baseline.

The invention discloses a method and a system for detecting abnormity of an interactive message of a source network load system. The method comprises the following steps: analyzing a collected networkdata packet to obtain message field contents; extracting instruction-level field content from the message field content; based on a preset message feature rule base, a violation service instruction rule base and an attack feature base, grammatical semantics, sequentially performing a service instruction and attack feature matching on the instruction-level field content, generating an alarm when one of the instruction-level field content is successfully matched, and achieving exception detection of the instruction-level content in the real-time interaction process of the source network load system.

The invention discloses an infrared image anomaly monitoring method, apparatus, device and system based on dual-light fusion. The infrared image anomaly monitoring method comprises the steps: acquiring a visible light image and an infrared image which are consistent in image display content and are synchronously collected; inputting the visible light image into a pre-trained neural network, and outputting a converted infrared image; respectively acquiring gray difference values of the same area in the converted infrared image and the infrared image; judging whether the gray difference value isgreater than a preset threshold value or not; and if so, determining that the region corresponding to the gray difference value is abnormal. The converted infrared image is converted from a visible light image; the gray value of each area is irrelevant to the temperature; when the temperature of a certain area is abnormal, the temperature is abnormal; and when the infrared images are abnormal, the gray values in the infrared images change, and the gray difference of the same area in the two images is obtained, and whether abnormality occurs or not is determined according to the relationship between the gray difference and a preset threshold value, and abnormality detection of all areas is achieved, and the infrared image anomaly monitoring method is not limited to the area with the highest temperature, and the abnormal area can be detected more effectively.

The invention discloses an elevator operation abnormity detection method based on sparse denoising self-coding. The method comprises the following steps: correspondingly acquiring time domain waveforms of normal vibration and abnormal vibration of an elevator; obtaining frequency domain waveforms of the normal vibration and the abnormal vibration according to the time domain waveforms of the normal vibration and the abnormal vibration; manufacturing a training set and a test set according to the time domain waveform and the frequency domain waveform; learning a training set by adopting single-layer sparse denoising self-coding to obtain a first neural network; adjusting the first neural network by adopting a stacked sparse denoising self-coding and BP algorithm to obtain a second neural network; testing the second neural network by using a test set to obtain a time domain reconstruction error and a frequency domain reconstruction error of each sample so as to obtain a fusion reconstruction error sequence; setting the median value of the fusion reconstruction error sequence as a threshold value for distinguishing normal data from abnormal data; and judging whether the signal to be detected is abnormal or not by utilizing a threshold value and a second neural network. The method solves the problem of too few abnormal samples and improves the efficiency and accuracy of abnormal detection.

The invention discloses a universal type lithium battery wireless charging system. A secondary side device comprises a lithium battery, a voltage acquisition module, a current acquisition module and asecondary side control module; the secondary side control module acquires voltage information and current information which are respectively acquired through the voltage acquisition module and the current acquisition module, compares the voltage information and the current information with a set voltage threshold value and a set current threshold value respectively to judge whether the lithium battery is abnormal or not, sends a lithium battery abnormality instruction to end the charging of the lithium battery when the voltage information or the current information exceeds the voltage threshold value or the current threshold value; and when the voltage information or the current information does not exceed the voltage threshold value or the current threshold value, the secondary side control module compares and judges the voltage information with an upper limit voltage of a preset voltage range of a charging stage of each mode, controls a corresponding charging mode to be turned on according to a judgment result, and ends the charging of the lithium battery according to a preset ending condition of the charging mode. The universal type lithium battery wireless charging system disclosed by the invention realizes automatic control of each mode of wireless charging and also improves the charging efficiency of the lithium battery.

The invention relates to a model anomaly detection method and apparatus, a computer device and a storage medium. The method comprises the steps of obtaining a configuration file which is set for a to-be-detected model index and comprises anomaly detection associated parameters; calling a universal code corresponding to the to-be-tested model index, and extracting sample selection time corresponding to the current model from the anomaly detection associated parameters; obtaining sample data conforming to the sample selection time from a database through the universal code; determining a value of the to-be-tested model index through the universal code and the sample data; when it is determined that the to-be-tested model index of the current model is abnormal according to the value of the to-be-tested model index, triggering an alarm logic code to generate an exception reminding mail; and sending the exception reminding mail to a terminal. The model anomaly detection efficiency can be improved.

The invention provides a monitoring index abnormity detection method and device based on streaming processing, and equipment. The method includes obtaining index information of the target monitoring index from the log information to form streaming data; reading the streaming data in a streaming manner, and aggregating the read streaming data to an aggregation window of a specified dimension; and performing anomaly detection on the streaming data in the aggregation window according to a predetermined trigger condition to judge whether the target monitoring index is abnormal or not. An anomaly detection algorithm is integrated on a streaming processing platform, real-time anomaly detection is conducted on data in a streaming mode, and minute-level or even second-level anomaly detection can be conducted on mass data.

The embodiment of the invention provides a time series data anomaly detection method and device, electronic equipment and a storage medium, and aims to improve anomaly detection efficiency and / or detection accuracy. The anomaly detection method for the time series data comprises the steps of according to a preset period, segmenting the time series data to be detected, and obtaining time series data segments with the time length being the preset period length; collecting a time series data segment, performing encoding operation on the time series data segment to obtain an encoding result, and performing decoding operation on the encoding result to obtain a decoded data segment, the encoding operation and the decoding operation being used for generating decoded data consistent with the timeseries data based on periodic time series data; and comparing the time series data segment with the decoded data segment to determine whether the time series data segment is abnormal or not.

The application provides a data processing method and apparatus. The data processing method comprises: at least one data object under a target category is obtained and is used as a to-be-processed data object; for each to-be-processed data object, an abnormity degree of the to-be-processed data object is obtained according to values of a designated business parameter of the to-be-processed data object on the condition of taking different attribute values by all detection attributes included by the to-be-processed data object; and according the abnormity degrees of all to-be-processed data objects, an abnormal data object among all to-be-processed data objects is determined. Therefore, abnormal data detection can be realized without any data marking.

The invention discloses a civil aviation engine gas path anomaly detection method, and belongs to the technical field of aero-engine detection. The civil aviation engine gas path anomaly detection method solves the problems that in the prior art, one-sidedness exists when a single characteristic parameter is adopted for carrying out anomaly detection on the engine, and hysteresis exists in information feedback in a CNR report and cannot meet the early warning requirement. The technical scheme adopted by the invention comprises the following steps: dividing a multi-dimensional gas path parameter deviation value time sequence into sub-sequences, carrying out secondary division on the sub-sequences, and screening significant characteristic parameters; and evaluating, optimizing and sequencingthe tail end features by using an entropy evaluation method, determining an anomaly detection feature matrix, and realizing gas path anomaly detection and early warning by using an isolated forest anomaly detection algorithm. Experiments prove that the civil aviation engine gas path anomaly detection method can well realize gas path anomaly detection, and has far-reaching guiding significance forengineering practical application.

The invention relates to a structural abnormality detection method based on consistent data replacement under incomplete data, which comprises the following steps: firstly, carrying out collection on a structural response by utilizing a plurality of sensors, wherein certain sensors become invalid, thereby, obtaining response signals containing the incomplete data; then, carrying out denoising processing on all the collected signals; subsequently, carrying out complete processing on the incomplete data in the signals by utilizing a consistent data replacement method; and finally, decomposing the completely processed data by utilizing a small wave to realize structural abnormality detection. The method is capable of well processing multiple-degree of freedom, non-free vibration, nonlinear, unsteady and incomplete response signals, can be used for signal processing in the field of civil engineering, aerospace, automatic control, mechanical engineering, bridge engineering, hydraulic engineering and the like, and has the characteristics of improving the anti-jamming capability of the data and improving the structural abnormality detection accuracy under the incomplete data.

The invention provides an anomaly detection method and device for a traffic light detection module in an automatic driving vehicle; the method comprises: acquiring a driving distance between the automatic driving vehicle and a traffic light intersection in an automatic driving vehicle driving process; detecting whether the traffic light detection module is abnormal or not by combining a traffic light detection result of the traffic light detection module when the driving distance is determined to be smaller than a preset distance threshold value, so that the abnormality of the traffic light detection module in the automatic driving vehicle is detected, the abnormality can be discovered in time, and the effectiveness and safety of the automatic driving vehicle passing through the traffic light intersection are improved.

The invention discloses a sound based coal mine tunnel abnormity monitoring device and method, and belongs to the technical field of automatic detection; the invention provides the sound based deviceand method, the expansibility of the device and the method is strong, and the abnormal state of a tunnel can be discovered in time; the technical scheme is as follows: the device is arranged in the coal mine tunnel and comprises a host, the host is provided with a metal shell, the metal shell is internally provided with a data storage module, a sound card module, a data processing module, and a microphone array arranged on the side surface of the metal shell, the microphone array is used for acquiring the sound in the coal mine tunnel, and transmitting the acquired sound to the sound card module; the sound card module converts an acoustical signal into an electric signal through acoustoelectric conversion, then the electric signal is transmitted to the data processing module, the data processing module processes and analyzes the electric signal through sound training and sound recognition, judges whether an abnormity occurs, and stores an analysis result in the data storage module.

The invention relates to artificial intelligence, and provides a service system anomaly detection method and device, computer equipment and a storage medium, and the method comprises the steps: constructing a multi-scale signature matrix according to the multivariate time sequence data of each index generated by a service system; inputting the multi-scale signature matrix into a convolution layerto encode a spatial mode of the multi-scale signature matrix, and outputting a spatial feature map; inputting the spatial feature map into an attention-based convolutional long-short-term memory network layer, and updating the hidden state of the spatial feature map through the attention-based convolutional long-short-term memory network layer to obtain an updated spatial feature map; inputting the updated spatial feature map into a deconvolution layer to decode and reconstruct the updated spatial feature map to obtain a reconstructed signature matrix; comparing the reconstructed signature matrix with the multi-scale signature matrix, and determining an abnormal index of the service system. In addition, the invention also relates to a blockchain technology, and the multivariate time seriesdata can be stored in the blockchain. By adopting the method, the anomaly detection accuracy can be improved.

The invention provides an anomaly detection method based on a cumulative sum control chart and applied to a satellite power supply system, relates to the field of power supply system fault diagnosis, and aims to solve the problems that a threshold value is wider, small faults cannot be detected and warned early and the like for conventional anomaly detection of the satellite power supply system. The method comprises the following steps: historical data of normal operation of an NI-MH battery type satellite power supply in a time period is acquired, and the hydrogen pressure value of the power supply is selected as an evaluation parameter; the hydrogen pressure value is divided into m groups, and the average value pj of each group of hydrogen pressure values is calculated; the statistical properties of the hydrogen pressure values of the power supply are calculated, and the allowed deviator and the threshold value of the cumulative sum control chart are determined; the average value pi of hydrogen pressure values of a to-be-detected satellite power supply is calculated; the average value pi of the hydrogen pressure values is taken as input of a cumulative sum function, and an output value is drawn in the cumulative sum control chart; whether the cumulative sums S+(i) and S-(i) corresponding to the hydrogen pressure values of the to-be-detected satellite power supply exceed the threshold value of the cumulative sum control chart is judged, and the current working state of the power supply system is judged. The method is applicable to the field of fault diagnosis for an NI-MH battery type satellite power supply system.

The invention discloses a machine learning based intrusion detection method of an industrial control system. Machine learning is carried out in a practical industrial environment, the IPs, port numbers and the like of control and execution ends are recorded, a model is established according to characteristics corresponding to data flow and time, and intrusion detection is carried out via the established model. If it is found that an unknown IP or port implements communication or the communication flow in certain period is greatly higher or lower than a threshold of a learning phase, alarming is carried out, and the communication security of the system is improved greatly; and the method can be suitable for intrusion detection in different industrial network environments, manual configuration is not needed, and abnormity detection can be realized via automatic learning.

The embodiment of the invention discloses an abnormal communication detection method and device, a server and a storage medium. The method comprises the following steps that: the network flow of an Internet of Vehicles platform is monitored in real time, and analysis is performed to obtain network communication data, wherein the network communication data comprises an access request frequency andan access request data packet; the network communication characteristics of the Internet of Vehicles platform are acquired according to the historical network communication records of the Internet ofVehicles platform, wherein the network communication characteristics comprise average access request frequency and average access request data packet capacity; and whether abnormal communication exists in the network flow of the Internet of Vehicles platform or not is judged according to the network communication data and the network communication characteristics of the Internet of Vehicles platform. According to the abnormal communication detection method and device, the server and the storage medium of the technical schemes of the embodiments of the invention, the abnormity detection of thecommunication between a vehicle and the Internet of Vehicles platform is realized, the supervision of the Internet of Vehicles platform is enhanced, and the safety of the communication between the vehicle and the Internet of Vehicles platform is ensured.

The embodiment of the invention discloses a display screen playing picture anomaly detection method, device and system. The display screen playing image anomaly detection method comprises the steps of: a surface acquisition step, acquiring a periodically shot field image which comprises a playing image of a target display screen; an image extraction step, continuously extracting images in a targetarea in the field picture, wherein the content of every two adjacent detection images in the plurality of continuous detection images is different, the target area is located in an area where the playing image of the target display screen is located in the field image, and the number of the plurality of continuous detection images is greater than or equal to 3; a detection analysis step, performing image analysis processing on the at least three continuous detection images to judge whether the playing image of the target display screen has a fault or not; and a failure notification step.

The invention discloses a low-voltage power distribution monitoring terminal data acquisition anomaly detection method and system, and the method comprises the steps: carrying out the clustering analysis of a pre-processed data sample of a low-voltage power distribution terminal through a clustering algorithm based on density, and obtaining an abnormal data sample; and judging whether the low-voltage power distribution terminal is abnormal in data acquisition or not according to the number of the abnormal data samples. According to the invention, anomaly detection is carried out on data acquisition of the low-voltage power distribution terminal, and meanwhile, the accuracy of anomaly detection is improved based on standardized processing and data cleaning of data samples of the low-voltage power distribution terminal.

The invention relates to the technical field of industrial equipment abnormality detection, and provides an industrial equipment abnormality detection method based on a fuzzy set. The method comprises: firstly, using an abnormal knowledge tree for constructing an abnormal detection model of industrial equipment; secondly, configuring an attribute set, an attribute data flow, a time window size, anattribute membership function and an aggregation function according to user requirements, and obtaining an abnormity degree of the leaf node; then, according to the Pearson correlation coefficient between the attributes, clustering the attributes, and calculating the weights of the leaf nodes; secondly, aggregating leaf nodes involved in the class cluster into non-leaf nodes, and aggregating thenon-leaf nodes into root nodes; after a user selects model parameters according to requirements, establishing a topological structure of flow processing of the abnormal detection model based on a Storm real-time computing system, and visualizing abnormal degree results of the industrial equipment in different time windows. According to the mehtod, the abnormity of the industrial equipment can be detected in real time, and the abnormity detection of data with different granularities can be realized.

The invention provides detection equipment and a detection method for an LED display terminal. The invention discloses a detection device of an LED display terminal. The LED display terminal comprisesa brightness acquisition module and a main control module, the brightness acquisition module comprises a sensor matrix composed of photosensitive sensors and is used for acquiring real-time brightness information of each LED in the LED display terminal and transmitting the acquired real-time brightness information of each LED to the main control module; And the main control module is used for comparing the acquired real-time brightness information of each LED according to the corresponding standard brightness information of each LED in the LED display terminal in the normal working state, anddetecting the LED with abnormal display in the LED display terminal according to a comparison result. According to the invention, the abnormity detection of the LED display terminal can be realized efficiently and accurately, the realization cost is low, and the practicability is wide.